Bug 241775 - [WebAuthn] WebAuthn catches error but still prompts user
Summary: [WebAuthn] WebAuthn catches error but still prompts user
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit API (show other bugs)
Version: Safari 15
Hardware: iPhone / iPad iOS 15
: P2 Normal
Assignee: pascoe@apple.com
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-06-19 22:13 PDT by Nina
Modified: 2022-07-01 00:09 PDT (History)
2 users (show)

See Also:


Attachments
A video showing the registration process - the face ID prompt is shown even though an error is thrown. (439.54 KB, video/mp4)
2022-06-19 22:13 PDT, Nina
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Nina 2022-06-19 22:13:27 PDT
Created attachment 460346 [details]
A video showing the registration process - the face ID prompt is shown even though an error is thrown.

The registration process with WebAuthn on IOS works fine and expected. As we use the same code on both android and IOS, we dont use discoverable credentials, but instead saves the credential-id in a cookie. If an user deletes his cookie, we can not see if the user has registered previously without prompting the user for registration again. This is okay, and if we get an InvalidStateError (because the user is already registered) we let the user think he has registered again, and just creates a new cookie.

The problem is: When the navigator.credentials.create() is called, the InvalidStateError is catched immideately, before the user have time to do anything about the faceID prompt which shows. When the InvalidStateError is caught, the Registration Completed page shows (See the video - "Biometri ble lagt til" in Norwegian). This means the completed page is shown behind the face-id prompt, which is very confusing for the user. How can the registration be completed if the face-id prompt is not finished?

On Windows, the InvalidStateError is not thrown before the user has completed the faceid prompt, which means the registration-process is experienced exactly as a first-time registration.

I think this might be a bug, that the prompt is shown even though the error is thrown? I would prefer the logic to be the same as on Windows - the error is thrown after the faceid prompt is completed, but not showing the prompt at all would also be better. 

Best regards, Nina
Comment 1 Radar WebKit Bug Importer 2022-06-20 17:21:09 PDT
<rdar://problem/95558853>
Comment 2 pascoe@apple.com 2022-06-28 15:46:19 PDT
Hi. Thank you for the report. 


What version of iOS are you running in the video?
Comment 3 Nina 2022-07-01 00:09:53 PDT
Hi. I have iOS 15.5!